521fde08efe2ab747ba0f6d801171e3c7e69be69193900724fe70887c4fe547a

Analysis

max time kernel
149s
max time network
149s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
28/07/2026, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bot_discord.elf
Size 829KB
Sample260728-ejwl4axfld
SHA256 521fde08efe2ab747ba0f6d801171e3c7e69be69193900724fe70887c4fe547a
MD5 3cbadf7a21dd11ec72afb3edd1d7e425
SHA1 36a4661d2f4b4c1117ae7f987b7ee06261fd0060
SHA512 6bfcf4d5c54a14a96bdffbac0192ddf87e8022279e8aa9b7a2eaea3c5a67d1a59611b3993ec9daed3c5bbd8da20af73b39697a61802b009d88504fa5032e0ead
SSDEEP 12288:AHtY3ok9gLRf2OVBCQ+e2Ngwe/eMdHH5nKmUW6woDWlayUpY7HXaX98qVwm4F4:Ai3okyLRfV4QN2Ngww9R6woDrYCVwm
TLSH
T1CE059E1BB2B3B6BDC01BC03047DBC6B25532F0751A322D7B26C4DA393E96DA5171AB25
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion

Malware Config

Signatures

Modifies Watchdog functionality 1 TTPs 1 IoCs

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

defense_evasion

Impair Defenses

T1562

description	ioc	Process
File opened for modification	/dev/misc/watchdog	bot_discord.elf

Changes its process name 1 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	/var/Sofia	1540	bot_discord.elf

/tmp/bot_discord.elf
/tmp/bot_discord.elf
1⤵
- Modifies Watchdog functionality
- Changes its process name
PID:1540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads